CVE-2026-74837 | CVSS: N/A
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.
AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mint
参考链接:
• https://cna.erlef.org/cves/CVE-2026-74837.html
• https://github.com/ash-project/ash_typescript/commit/df95df4b9afdca5e5bbce32dbd5
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mhxc-mhqx
📌 数据来源: NVD 官方